Google Calendar API vs YouCanBookMe API

Google Calendar API 88

Google publishes a discovery document rather than OpenAPI, which is a machine-readable contract all the same, at revision 20261028 on 1 November (25). No llms.txt, and developers.google.com/llms.txt and /workspace/calendar/llms.txt returned 404 again on 1 November, but doc pages return Markdown when .md.txt is appended to the URL, which we found no index or link advertising, read as for Drive, Sheets and Forms (5 of 10). Reference pages say what each method does and when to use patch over update, but we couldn't read the MCP tool descriptions (15). Typed parameters with enums such as orderBy and eventTypes (13). An error page that gives each reason code a recommended action, from timeRangeEmpty to fullSyncRequired (15). v3 in the path and dated release notes, latest 12 October 2026, with nothing newer on 1 November (15).

YouCanBookMe API 10

The reference lives on Stoplight at ycbm.stoplight.io, which usually renders an OpenAPI file, but our reader got only the workspace shell, and no spec file was found at the usual paths; the help centre article on support.youcanbook.me sat behind a Cloudflare challenge. Scored absent (0 of 25). No llms.txt on youcanbook.me, the help centre or the Stoplight host (0). Descriptions, typed inputs and required fields unread (0 of 20, 0 of 15). The one response we saw is a JSON envelope with code, errors, httpCode, message and status, and the help centre gives a worked webhook payload (4 of 15). A /v1 path and x-api-version: 1.18 and x-api-revision headers, with a product updates page dated by month and no API changelog (6 of 15). 0 + 0 + 0 + 0 + 4 + 6 = 10.

Google Calendar API 91

Responses size with maxResults and Google's standard fields partial responses (20). pageToken, syncToken, timeMin and timeMax, q and singleEvents for expanding recurrences (20). Error reasons an agent can act on, with the action written next to each one (20). Client-supplied event IDs make creates safe to retry and ETags guard updates. We found no readOnlyHint or destructiveHint on the MCP's write tools (16). Official client libraries in many languages, and most parameters are optional (15).

YouCanBookMe API 13

Response sizing, field selection and pagination are in the unread reference (3 of 25, 0 of 20). The error envelope names a machine code and a message an agent can branch on (8 of 20). No idempotency key or safe-retry guidance found (0 of 20). No official SDK, and the required parameters are unread (2 of 15). 3 + 0 + 8 + 0 + 2 = 13.

Google Calendar API 90

The Google Workspace Status Dashboard lists Calendar with component history and an incidents feed (20). On 1 November the dashboard's 365-day list shows two Calendar incidents, 31 May 2026 (56 minutes, several Workspace products) and 13 March 2026 (2 hours 30 minutes of intermittent errors), with none in the 90 days to 1 November. Other Workspace products have incidents in August and September (Drive, Gmail, Chat, Classroom and Gemini), none naming Calendar. The dashboard tracks the Calendar product rather than the API alone (30). 10,000 requests a minute per project, 600 a minute per user per project and 1,000,000 a day per project, unchanged on 1 November (15). 403 and 429 usageLimits errors with a truncated exponential backoff formula, client-supplied event IDs that return 409 on a duplicate, and ETags with 412 on a stale write (15). No SLA for the API found (0). The REST API is GA. The MCP server is still a developer preview on 1 November (10).

YouCanBookMe API 15

Read with the hosted lines. The help page links a status page at www.youcanbookmestatus.com, but the host did not resolve from our reader with or without www on 3 November 2026, so it is scored as not established rather than as a finding about the vendor (0). No readable history (5). No rate limit with a number in the help centre articles, the pricing page or the API's own error response; the API reference could not be read (0). No 429 or retry guidance and no idempotency key found (0). No SLA, and the terms say the service is not guaranteed to be available 100 per cent of the time (0). The API reports version 1.18 in its headers and is sold on the Team plan, so generally available (10). 0 + 5 + 0 + 0 + 0 + 10 = 15.

Google Calendar API 87

@googleapis/calendar 20.1.0 on 3 October 2026 is still the newest on npm on 1 November, 29 days earlier, and the discovery document has moved to revision 20261028 (30). Release notes on 12 October, plus client releases on 10, 14 and 24 September and 3 October, all within the 90 days to 1 November (the July notes have aged out) (20). Dated release notes and public client repositories with active maintainers (12). Current official client libraries (15). Generated clients rebuilt by CI in google-api-nodejs-client, with commits up to 30 October in a clone on 1 November (10).

YouCanBookMe API 28

Read as a closed service. The newest product update is dated September 2026 (registered SMS numbers), within 90 days but not 30, taking the month's first day (20 of 30). The previous entry is November 2025, so fewer than three in 90 days (0 of 20). A help centre, a community forum at forum.youcanbook.me and one-to-one support for paid users, with a product updates page that carries no API items (8 of 15). No official SDKs found (0). No package to assess (0). 20 + 0 + 8 + 0 + 0 = 28.

Google Calendar API 77

OAuth 2.0 with 20 Calendar scopes on the auth page, from calendar.freebusy and calendar.events.owned.readonly up to full calendar, and the discovery document (revision 20261028) carries a 21st, calendar.settings, which the auth page still doesn't list on 1 November (30), less 10 because the discovery document lists oauth_token and key as query parameters, the API also reads access_token from the query string, and Google's OAuth web-server guide shows the query string as an alternative to the header, read as for Gmail, Sheets and Forms (20). The auth page's table gives each scope's meaning only, and the non-sensitive, sensitive and restricted classes are per the 1 October check, not re-read on 4 or 17 October. Read-only and free/busy-only scopes, and the MCP guide (updated 29 October) still configures three read-only scopes. Nothing in the API confirms a delete (17). The MCP guide, updated 29 October, warns about indirect prompt injection and says prompts and responses must be screened, with Model Armor or a documented alternative, and tells operators to review AI-initiated actions (12). The Cloud console API dashboard shows traffic, errors by method and response code, and latency percentiles per project, but not a per-call log (8). Valid security.txt to 2030 with contacts and the Google VRP bug bounty policy, read on 1 November. Google's SOC 2 page sends customers to Compliance Reports Manager for the Google Workspace reports, and that Calendar is in their scope is per the 4 October check (20).

YouCanBookMe API 24

One account-wide API key sent as the HTTP Basic password with the account ID or email, generated and deleted by the Account Owner only; no scopes, expiry or per-user keys are documented (10 of 30). No read-only mode or confirmation step found (0 of 20). The API and webhooks carry names, answers and notes written by people who book, with no injection guidance (2 of 15). No audit log or per-call visibility found (0 of 15). SOC 2 Type II and ISO/IEC 27001:2022 (certificate 20/3433, 20 February 2024) and third-party penetration tests on the security page, but no security.txt (404), bug bounty or disclosure policy (12 of 20). 10 + 0 + 2 + 0 + 12 = 24.

Google Calendar API 82

Closed service under Google's API terms, with Apache-2.0 client libraries (15). Google's privacy policy covers end users, and the Workspace data processing terms cover tenants, but we didn't find one retention statement for Calendar API data (18). Dated announcements ahead of changes, such as the 1 June notice for the 29 June GA of writerWithoutPrivateAccess at least 90 days' notice promised before quota charges, and the 12 October notice that Workspace MCP servers reject OAuth clients not marked agentic from 11 November 2026 (15). The Workspace sub-processor list, last modified 19 October 2026, names Google group and third-party sub-processors with the countries each processes in, and covers Calendar as a Core Service for Workspace tenants (20).

YouCanBookMe API 61

Closed service with terms (18 March 2026) naming AI Software (Capacity) UK Ltd under English law, which bar data-mining and robot tools without consent and let the company end membership without notice for a breach (15 of 30). The privacy notice (16 March 2026) states retention periods (24 months for booking data by default, 7 years for support messages), AWS hosting in the United States, a DPA on request and no training of external AI models on booking data; the security page says no subprocessor list is published, and the two agree on AWS (22 of 30). No deprecation policy or dated notice, and clause 18.4 allows changes to the service without notice (3 of 20). Providers are named in the privacy notice (AWS, Stripe, Google Analytics, Mixpanel, Hotjar, HubSpot) with US hosting, but there is no list with locations per processor (12 of 20). 15 + 22 + 3 + 12 = 52.